±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 33948
New Yesterday: 0 Visitors: 155

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Encase 8.07 APFS

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Encase 8.07 APFS

Post Posted: Wed May 16, 2018 10:33 am


As most of you have probably seen Opentext are now saying they support APFS within encase 8.07. Has anyone actually got this to work?

I have a physical image of a drive from a macbook, the drive has an unencrypted APFS volume but when loading into encase all i get is an entry called 'mastersuperblockcontainer' and below that about 128 entries called checkpoint. I can mount the image on a mac and view the data without problem, also blacklight can parse the image without issue.

I have spoken to opentext and they are dodging the issue blaming the problem on the method of e01 creation (Guymager).

Has anyone actually managed to view data from an apfs volume within encase?



Re: Encase 8.07 APFS

Post Posted: Thu May 17, 2018 2:56 am

Works for me  

Senior Member

Re: Encase 8.07 APFS

Post Posted: Fri May 18, 2018 6:57 am

I'm having the same issue with an E01 created using Macquisition 2018R1.2

This admittedly is an Encrypted APFS and blacklight is the only program I know so far that can decrypt it.  


Page 1 of 1